Silent 403 when okta token does not have correct permissions when managing group membership #2866

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Terraform Version & Okta Provider Version(s)

Terraform v1.15.6
on mac os Version 26.5.1

• provider registry.terraform.io/providers/okta/okta/ v6.7.0

Affected Resource(s)

okta_group_memberships

Can this be done in the Admin UI?

No

Can this be done in the actual API call?

No

Customer Information

Organization Name: bandwidth
Paid Customer: yes

Terraform Configuration

resource "okta_group" "subordinate_teams" {
  for_each    = var.explicit_members_subordinate_teams
  name        = each.key
  description = "Foo"
}

resource "okta_group_memberships" "subordinate_teams_memberships" {
  for_each = okta_group.subordinate_teams
  group_id = each.value.id
  users = [
    for user_login in var.explicit_members_subordinate_teams[each.value.name] :
    local.login_id_map[user_login] if lookup(local.login_id_map, user_login, "") != ""
  ]
}

Debug Output

026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0: {
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0:  "errorCode": "E0000006",
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0:  "errorSummary": "You do not have permission to perform the requested action",
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0:  "errorLink": "E0000006",
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0:  "errorId": "oaeKxtVirzPR_6HFPolr3wbNw",
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0:  "errorCauses": []
2026-06-23T17:00:21.160-0400 [DEBUG] provider.terraform-provider-okta_v6.7.0: }

Expected Behavior

Expect a terraform apply to error out and fail

Actual Behavior

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Steps to reproduce

1. terraform apply with a token that has read on group but not write

Important Factoids

No response

References

No response